<!DOCTYPE html>
<html lang="en-us">
  <head>

    <meta http-equiv="content-type" content="text/html; charset=utf-8">
    
<meta charset="UTF-8">
<title>elasticsearch-keystore | Elasticsearch Guide [7.7] | Elastic</title>
<link rel="home" href="index.html" title="Elasticsearch Guide [7.7]">
<link rel="up" href="commands.html" title="Command line tools">
<link rel="prev" href="_parameters_8.html" title="Parameters">
<link rel="next" href="migrate-tool.html" title="elasticsearch-migrate">
<meta name="DC.type" content="Learn/Docs/Elasticsearch/Reference/7.7">
<meta name="DC.subject" content="Elasticsearch">
<meta name="DC.identifier" content="7.7">
<meta name="robots" content="noindex,nofollow">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <script src="https://cdn.optimizely.com/js/18132920325.js"></script>
    <link rel="apple-touch-icon" sizes="57x57" href="/apple-icon-57x57.png">
    <link rel="apple-touch-icon" sizes="60x60" href="/apple-icon-60x60.png">
    <link rel="apple-touch-icon" sizes="72x72" href="/apple-icon-72x72.png">
    <link rel="apple-touch-icon" sizes="76x76" href="/apple-icon-76x76.png">
    <link rel="apple-touch-icon" sizes="114x114" href="/apple-icon-114x114.png">
    <link rel="apple-touch-icon" sizes="120x120" href="/apple-icon-120x120.png">
    <link rel="apple-touch-icon" sizes="144x144" href="/apple-icon-144x144.png">
    <link rel="apple-touch-icon" sizes="152x152" href="/apple-icon-152x152.png">
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-icon-180x180.png">
    <link rel="icon" type="image/png" href="/favicon-32x32.png" sizes="32x32">
    <link rel="icon" type="image/png" href="/android-chrome-192x192.png" sizes="192x192">
    <link rel="icon" type="image/png" href="/favicon-96x96.png" sizes="96x96">
    <link rel="icon" type="image/png" href="/favicon-16x16.png" sizes="16x16">
    <link rel="manifest" href="/manifest.json">
    <meta name="apple-mobile-web-app-title" content="Elastic">
    <meta name="application-name" content="Elastic">
    <meta name="msapplication-TileColor" content="#ffffff">
    <meta name="msapplication-TileImage" content="/mstile-144x144.png">
    <meta name="theme-color" content="#ffffff">
    <meta name="naver-site-verification" content="936882c1853b701b3cef3721758d80535413dbfd">
    <meta name="yandex-verification" content="d8a47e95d0972434">
    <meta name="localized" content="true">
    <meta name="st:robots" content="follow,index">
    <meta property="og:image" content="https://www.elastic.co/static/images/elastic-logo-200.png">
    <link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">
    <link rel="icon" href="/favicon.ico" type="image/x-icon">
    <link rel="apple-touch-icon-precomposed" sizes="64x64" href="/favicon_64x64_16bit.png">
    <link rel="apple-touch-icon-precomposed" sizes="32x32" href="/favicon_32x32.png">
    <link rel="apple-touch-icon-precomposed" sizes="16x16" href="/favicon_16x16.png">
    <!-- Give IE8 a fighting chance -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/html5shiv/3.7.2/html5shiv.min.js"></script>
    <script src="https://oss.maxcdn.com/respond/1.4.2/respond.min.js"></script>
    <![endif]-->
    <link rel="stylesheet" type="text/css" href="/guide/static/styles.css">
  </head>

  <!--© 2015-2021 Elasticsearch B.V. Copying, publishing and/or distributing without written permission is strictly prohibited.-->

  <body>
    <!-- Google Tag Manager -->
    <script>dataLayer = [];</script><noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-58RLH5" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
    <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= '//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-58RLH5');</script>
    <!-- End Google Tag Manager -->

    <!-- Global site tag (gtag.js) - Google Analytics -->
    <script async src="https://www.googletagmanager.com/gtag/js?id=UA-12395217-16"></script>
    <script>
      window.dataLayer = window.dataLayer || [];
      function gtag(){dataLayer.push(arguments);}
      gtag('js', new Date());
      gtag('config', 'UA-12395217-16');
    </script>

    <!--BEGIN QUALTRICS WEBSITE FEEDBACK SNIPPET-->
    <script type="text/javascript">
      (function(){var g=function(e,h,f,g){
      this.get=function(a){for(var a=a+"=",c=document.cookie.split(";"),b=0,e=c.length;b<e;b++){for(var d=c[b];" "==d.charAt(0);)d=d.substring(1,d.length);if(0==d.indexOf(a))return d.substring(a.length,d.length)}return null};
      this.set=function(a,c){var b="",b=new Date;b.setTime(b.getTime()+6048E5);b="; expires="+b.toGMTString();document.cookie=a+"="+c+b+"; path=/; "};
      this.check=function(){var a=this.get(f);if(a)a=a.split(":");else if(100!=e)"v"==h&&(e=Math.random()>=e/100?0:100),a=[h,e,0],this.set(f,a.join(":"));else return!0;var c=a[1];if(100==c)return!0;switch(a[0]){case "v":return!1;case "r":return c=a[2]%Math.floor(100/c),a[2]++,this.set(f,a.join(":")),!c}return!0};
      this.go=function(){if(this.check()){var a=document.createElement("script");a.type="text/javascript";a.src=g;document.body&&document.body.appendChild(a)}};
      this.start=function(){var a=this;window.addEventListener?window.addEventListener("load",function(){a.go()},!1):window.attachEvent&&window.attachEvent("onload",function(){a.go()})}};
      try{(new g(100,"r","QSI_S_ZN_emkP0oSe9Qrn7kF","https://znemkp0ose9qrn7kf-elastic.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_emkP0oSe9Qrn7kF")).start()}catch(i){}})();
    </script><div id="ZN_emkP0oSe9Qrn7kF"><!--DO NOT REMOVE-CONTENTS PLACED HERE--></div>
    <!--END WEBSITE FEEDBACK SNIPPET-->

    <div id="elastic-nav" style="display:none;"></div>
    <script src="https://www.elastic.co/elastic-nav.js"></script>

    <!-- Subnav -->
    <div>
      <div>
        <div class="tertiary-nav d-none d-md-block">
          <div class="container">
            <div class="p-t-b-15 d-flex justify-content-between nav-container">
              <div class="breadcrum-wrapper"><span><a href="/guide/" style="font-size: 14px; font-weight: 600; color: #000;">Docs</a></span></div>
            </div>
          </div>
        </div>
      </div>
    </div>

    <div class="main-container">
      <section id="content">
        <div class="content-wrapper">

          <section id="guide" lang="en">
            <div class="container">
              <div class="row">
                <div class="col-xs-12 col-sm-8 col-md-8 guide-section">
                  <!-- start body -->
                  <div class="page_header">
<strong>IMPORTANT</strong>: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
<a href="../current/index.html">current release documentation</a>.
</div>
<div id="content">
<div class="breadcrumbs">
<span class="breadcrumb-link"><a href="index.html">Elasticsearch Guide [7.7]</a></span>
»
<span class="breadcrumb-link"><a href="commands.html">Command line tools</a></span>
»
<span class="breadcrumb-node">elasticsearch-keystore</span>
</div>
<div class="navheader">
<span class="prev">
<a href="_parameters_8.html">« Parameters</a>
</span>
<span class="next">
<a href="migrate-tool.html">elasticsearch-migrate »</a>
</span>
</div>
<div class="chapter">
<div class="titlepage"><div><div>
<h2 class="title">
<a id="elasticsearch-keystore"></a>elasticsearch-keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h2>
</div></div></div>
<p>The <code class="literal">elasticsearch-keystore</code> command manages <a class="xref" href="secure-settings.html" title="Secure settings">secure settings</a>
in the Elasticsearch keystore.</p>
<h3>
<a id="elasticsearch-keystore-synopsis"></a>Synopsis<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h3>
<div class="pre_wrapper lang-shell">
<pre class="programlisting prettyprint lang-shell">bin/elasticsearch-keystore
([add &lt;settings&gt;] [-f] [--stdin] |
[add-file (&lt;setting&gt; &lt;path&gt;)+] | [create] [-p] |
[list] | [passwd] | [remove &lt;setting&gt;] | [upgrade])
[-h, --help] ([-s, --silent] | [-v, --verbose])</pre>
</div>
<h3>
<a id="elasticsearch-keystore-description"></a>Description<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h3>
<div class="important admon">
<div class="icon"></div>
<div class="admon_content">
<p>This command should be run as the user that will run Elasticsearch.</p>
</div>
</div>
<p>Currently, all secure settings are node-specific settings that must have the
same value on every node. Therefore you must run this command on every node.</p>
<p>When the keystore is password-protected, you must supply the password each time
Elasticsearch starts.</p>
<p>Modifications to the keystore do not take effect until you restart Elasticsearch.</p>
<p>Only some settings are designed to be read from the keystore. However, there
is no validation to block unsupported settings from the keystore and they can
cause Elasticsearch to fail to start. To see whether a setting is supported in the
keystore, see the setting reference.</p>
<h3>
<a id="elasticsearch-keystore-parameters"></a>Parameters<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h3>
<div class="variablelist">
<dl class="variablelist">
<dt>
<span class="term">
<code class="literal">add &lt;settings&gt;</code>
</span>
</dt>
<dd>
Adds settings to the keystore. Multiple setting names can be
specified as arguments to the <code class="literal">add</code> command. By default, you are prompted for
the values of the settings. If the keystore is password protected, you are also
prompted to enter the password. If a setting already exists in the keystore, you
must confirm that you want to overwrite the current value. If the keystore does
not exist, you must confirm that you want to create a keystore. To avoid these
two confirmation prompts, use the <code class="literal">-f</code> parameter.
</dd>
<dt>
<span class="term">
<code class="literal">add-file (&lt;setting&gt; &lt;path&gt;)+</code>
</span>
</dt>
<dd>
Adds files to the keystore.
</dd>
<dt>
<span class="term">
<code class="literal">create</code>
</span>
</dt>
<dd>
Creates the keystore.
</dd>
<dt>
<span class="term">
<code class="literal">-f, --force</code>
</span>
</dt>
<dd>
When used with the <code class="literal">add</code> parameter, the command no longer prompts you
before overwriting existing entries in the keystore. Also, if you haven’t
created a keystore yet, it creates a keystore that is obfuscated but not
password protected.
</dd>
<dt>
<span class="term">
<code class="literal">-h, --help</code>
</span>
</dt>
<dd>
Returns all of the command parameters.
</dd>
<dt>
<span class="term">
<code class="literal">list</code>
</span>
</dt>
<dd>
Lists the settings in the keystore. If the keystore is password
protected, you are prompted to enter the password.
</dd>
<dt>
<span class="term">
<code class="literal">-p</code>
</span>
</dt>
<dd>
When used with the <code class="literal">create</code> parameter, the command prompts you to enter a
keystore password. If you don’t specify the <code class="literal">-p</code> flag or if you enter an empty
password, the keystore is obfuscated but not password protected.
</dd>
<dt>
<span class="term">
<code class="literal">passwd</code>
</span>
</dt>
<dd>
Changes or sets the keystore password. If the keystore is password
protected, you are prompted to enter the current password and the new one. You
can optionally use an empty string to remove the password. If the keystore is
not password protected, you can use this command to set a password.
</dd>
<dt>
<span class="term">
<code class="literal">remove &lt;settings&gt;</code>
</span>
</dt>
<dd>
Removes settings from the keystore. Multiple setting
names can be specified as arguments to the <code class="literal">remove</code> command.
</dd>
<dt>
<span class="term">
<code class="literal">-s, --silent</code>
</span>
</dt>
<dd>
Shows minimal output.
</dd>
<dt>
<span class="term">
<code class="literal">-x, --stdin</code>
</span>
</dt>
<dd>
When used with the <code class="literal">add</code> parameter, you can pass the settings values
through standard input (stdin). Separate multiple values with carriage returns
or newlines. See <a class="xref" href="elasticsearch-keystore.html#add-string-to-keystore" title="Add settings to the keystore">Add settings to the keystore</a>.
</dd>
<dt>
<span class="term">
<code class="literal">upgrade</code>
</span>
</dt>
<dd>
Upgrades the internal format of the keystore.
</dd>
<dt>
<span class="term">
<code class="literal">-v, --verbose</code>
</span>
</dt>
<dd>
Shows verbose output.
</dd>
</dl>
</div>
<h3>
<a id="elasticsearch-keystore-examples"></a>Examples<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h3>
<h4>
<a id="creating-keystore"></a>Create the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>To create the <code class="literal">elasticsearch.keystore</code>, use the <code class="literal">create</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore create -p</pre>
</div>
<p>You are prompted to enter the keystore password. A password-protected
<code class="literal">elasticsearch.keystore</code> file is created alongside the <code class="literal">elasticsearch.yml</code> file.</p>
<h4>
<a id="changing-keystore-password"></a>Change the password of the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>To change the password of the <code class="literal">elasticsearch.keystore</code>, use the <code class="literal">passwd</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore passwd</pre>
</div>
<p>If the Elasticsearch keystore is password protected, you are prompted to enter the
current password and then enter the new one. If it is not password protected,
you are prompted to set a password.</p>
<h4>
<a id="list-settings"></a>List settings in the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>To list the settings in the keystore, use the <code class="literal">list</code> command.</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore list</pre>
</div>
<p>If the Elasticsearch keystore is password protected, you are prompted to enter the
password.</p>
<h4>
<a id="add-string-to-keystore"></a>Add settings to the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>Sensitive string settings, like authentication credentials for Cloud plugins,
can be added with the <code class="literal">add</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore add the.setting.name.to.set</pre>
</div>
<p>You are prompted to enter the value of the setting. If the Elasticsearch keystore is
password protected, you are also prompted to enter the password.</p>
<p>You can also add multiple settings with the <code class="literal">add</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore add \
  the.setting.name.to.set \
  the.other.setting.name.to.set</pre>
</div>
<p>You are prompted to enter the values of the settings. If the Elasticsearch keystore is
password protected, you are also prompted to enter the password.</p>
<p>To pass the settings values through standard input (stdin), use the <code class="literal">--stdin</code>
flag:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">cat /file/containing/setting/value | bin/elasticsearch-keystore add --stdin the.setting.name.to.set</pre>
</div>
<p>Values for multiple settings must be separated by carriage returns or newlines.</p>
<h4>
<a id="add-file-to-keystore"></a>Add files to the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>You can add sensitive files, like authentication key files for Cloud plugins,
using the <code class="literal">add-file</code> command. Settings and file paths are specified in pairs
consisting of <code class="literal">setting path</code>.</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore add-file the.setting.name.to.set /path/example-file.json</pre>
</div>
<p>You can add multiple files with the <code class="literal">add-file</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore add-file \
  the.setting.name.to.set /path/example-file.json \
  the.other.setting.name.to.set /path/other-example-file.json</pre>
</div>
<p>If the Elasticsearch keystore is password protected, you are prompted to enter the
password.</p>
<h4>
<a id="remove-settings"></a>Remove settings from the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>To remove a setting from the keystore, use the <code class="literal">remove</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore remove the.setting.name.to.remove</pre>
</div>
<p>You can also remove multiple settings with the <code class="literal">remove</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore remove \
  the.setting.name.to.remove \
  the.other.setting.name.to.remove</pre>
</div>
<p>If the Elasticsearch keystore is password protected, you are prompted to enter the
password.</p>
<h4>
<a id="keystore-upgrade"></a>Upgrade the keystore<a class="edit_me edit_me_private" rel="nofollow" title="Editing on GitHub is available to Elastic" href="https://github.com/elastic/elasticsearch/edit/7.7/docs/reference/commands/keystore.asciidoc">edit</a>
</h4>
<p>Occasionally, the internal format of the keystore changes. When Elasticsearch is
installed from a package manager, an upgrade of the on-disk keystore to the new
format is done during package upgrade. In other cases, Elasticsearch performs the upgrade
during node startup. This requires that Elasticsearch has write permissions to the
directory that contains the keystore. Alternatively, you can manually perform
such an upgrade by using the <code class="literal">upgrade</code> command:</p>
<div class="pre_wrapper lang-sh">
<pre class="programlisting prettyprint lang-sh">bin/elasticsearch-keystore upgrade</pre>
</div>
</div>
<div class="navfooter">
<span class="prev">
<a href="_parameters_8.html">« Parameters</a>
</span>
<span class="next">
<a href="migrate-tool.html">elasticsearch-migrate »</a>
</span>
</div>
</div>

                  <!-- end body -->
                </div>
                <div class="col-xs-12 col-sm-4 col-md-4" id="right_col">
                  <div id="rtpcontainer" style="display: block;">
                    <div class="mktg-promo">
                      <h3>Most Popular</h3>
                      <ul class="icons">
                        <li class="icon-elasticsearch-white"><a href="https://www.elastic.co/webinars/getting-started-elasticsearch?baymax=default&amp;elektra=docs&amp;storm=top-video">Get Started with Elasticsearch: Video</a></li>
                        <li class="icon-kibana-white"><a href="https://www.elastic.co/webinars/getting-started-kibana?baymax=default&amp;elektra=docs&amp;storm=top-video">Intro to Kibana: Video</a></li>
                        <li class="icon-logstash-white"><a href="https://www.elastic.co/webinars/introduction-elk-stack?baymax=default&amp;elektra=docs&amp;storm=top-video">ELK for Logs &amp; Metrics: Video</a></li>
                      </ul>
                    </div>
                  </div>
                </div>
              </div>
            </div>
          </section>

        </div>


<div id="elastic-footer"></div>
<script src="https://www.elastic.co/elastic-footer.js"></script>
<!-- Footer Section end-->

      </section>
    </div>

<script src="/guide/static/jquery.js"></script>
<script type="text/javascript" src="/guide/static/docs.js"></script>
<script type="text/javascript">
  window.initial_state = {}</script>
  </body>
</html>
